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Introduction 


The Information Commissioner (the Commissioner) is calling for evidence 
and views on the Age Appropriate Design Code (the Code). 


The Code is a requirement of the Data Protection Act 2018 (the Act). The 
Act supports and supplements the implementation of the EU General Data 
Protection Regulation (the GDPR). 


The Code will provide guidance on the design standards that the 
Commissioner will expect providers of online ‘Information Society 
Services’ (ISS), which process personal data and are likely to be accessed 
by children, to meet. Once it has been published, the Commissioner will 
be required to take account of any provisions of the Code she considers to 
be relevant when exercising her regulatory functions. The courts and 
tribunals will also be required to take account of any provisions they 
consider to be relevant in proceedings brought before them. The Code 
may be submitted as evidence in court proceedings. 


Further guidance on how the GDPR applies to children’s personal data can 
be found in our guidance Children and the GDPR. It will be useful to read 
this before responding to the call for evidence, to understand what is 
already required by the GDPR and what the ICO currently recommends as 
best practice. In drafting the Code the ICO may consider suggestions that 
reinforce the specific requirements of the GDPR, or its overarching 
requirement that children merit special protection, but will disregard any 
suggestions that fall below this standard. 


The Commissioner will be responsible for drafting the Code. The Act 
provides that the Commissioner must consult with relevant stakeholders 
when preparing the Code, and submit it to the Secretary of State for 
Parliamentary approval within 18 months of 25 May 2018. She will publish 
the Code once it has been approved by Parliament. 


This call for evidence is the first stage of the consultation process. The 
Commissioner seeks evidence and views on the development stages of 
childhood and age-appropriate design standards for ISS. The 
Commissioner is particularly interested in evidence based submissions 
provided by: bodies representing the views of children or parents; child 
development experts; providers of online services likely to be accessed by 
children, and trade associations representing such providers. She 
appreciates that different stakeholders will have different and particular 
areas of expertise. The Commissioner welcomes responses that are 
limited to specific areas of interest or expertise and only address 
questions within these areas, as well as those that address every question 
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asked. She is not seeking submissions from individual children or parents 
in this call for evidence as she intends to engage with these stakeholder 
groups via other dedicated and specifically tailored means. 


The Commissioner will use the evidence gathered to inform further work 
in developing the content of the Code. 


The scope of the Code 


The Act affords the Commissioner discretion to set such standards of age 
appropriate design as she considers to be desirable, having 

regard to the best interests of children, and to provide such guidance as 
she considers appropriate. 


In exercising this discretion the Act requires the Commissioner to have 
regard to the fact that children have different needs at different ages, and 
to the United Kingdom’s obligations under the United Nations Convention 
on the Rights of the Child. 


During Parliamentary debate the Government committed to supporting 
the Commissioner in her development of the Code by providing her with a 
list of ‘minimum standards to be taken into account when designing it.’ 
The Commissioner will have regard to this list both in this call for 
evidence, and when exercising her discretion to develop such standards 
as she considers to be desirable 


In developing the Code the Commissioner will also take into account that 
the scope and purpose of the Act, and her role in this respect, is limited to 
making provision for the processing of personal data. 


Responses to this call for evidence must be submitted by 19 September 
2018. You can submit your response in one of the following ways: 


Online 


Download this document and email to: 


childrenandtheGDPR@ICO.org.uk 


Print off this document and post to: 

Age Appropriate Design Code call for evidence 
Engagement Department 

Information Commissioner’s Office 

Wycliffe House 

Water Lane 

Wilmslow 
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Cheshire SK9 5AF 


If you would like further information on the call for evidence please 
telephone 0303 123 1113 and ask to speak to the Engagement 
Department about the Age Appropriate Design Code or email 


childrenandtheGDPR@ICO.org.uk 


Privacy statement 

For this call for evidence we will publish responses received from 
organisations but will remove any personal data before publication. We 
will not publish responses from individuals. For more information about 
what we do with personal data please see our privacy notice. 
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Section 1: Your views and evidence 


Please provide us with your views and evidence in the following areas: 


Development needs of children at different ages 


The Act requires the Commissioner to take account of the development 
needs of children at different ages when drafting the Code. 


The Commissioner proposes to use their age ranges set out in the report 
Digital Childhood - addressing childhood development milestones in the 
Digital Environment as a starting point in this respect. This report draws 
upon a number of sources including findings of the United Kingdom 
Council for Child Internet Safety (UKCCIS) Evidence Group in its literature 


review of Children’s online activities risks and safety. 


The proposed age ranges are as follows: 


3-5 
6-9 
10-12 
13-15 
16-17 


Q1. In terms of setting design standards for the processing of children’s 
personal data by providers of ISS (online services), how appropriate you 
consider the above age brackets would be (delete as appropriate): 


Not at all appropriate 
Not really appropriate 
Quite appropriate 
Very appropriate 


Q1A. Please provide any views or evidence on how appropriate you 
consider the above age brackets would be in setting design standards for 
the processing of children’s personal data by providers of ISS (online 
services), 


Q2. Please provide any views or evidence you have on children’s 
development needs, in an online context in each or any of the above age 
brackets. 
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Children are now used to the digital world from birth, and will never know 
a world without an online life. Their parents are instrumental in helping 
them to understand and safely navigate the online world, and we know 
that being equipped to fulfil this duty is an area of concern for many 
parents. 


In our Annual Parent Survey 2016, 90% told us that it is very or 
somewhat important that their child's school delivers good quality 
education or support around cyber-bullying. 88% said the same for 
emotional health, which is needed when navigating the online world and 
understanding how to safely manage social media and other online 
interactions, as well as those in the real world. In an earlier survey in 
2016 of 627 parents, 85% told us they had concerns about cyber- 
bullying, which suggests that the issue remains prevalent for parents over 
recent time. Our Annual Parent Survey 2016 also revealed that 78% of 
parents consider it very or somewhat important that their child’s school 
delivers good quality sex education, with 46% of C2DE parents saying it is 
‘very important’ to them compared to 41% of ABC1 parents. This 
suggests that parents from lower socio-economic backgrounds have 
greater concern that their child receives good quality sex education 
compared to their peers on higher incomes. 


Over 300 parents responded to a January 2018 survey we ran which 
informed our response to the Department for Education’s consultation on 
Relationships Education and Relationships and Sex Education (RE/RSE). 
Overall, we found that issues around online safety topped their concerns. 
Within the catchall subject of online safety, social media (mentioned by 
30 parents) was by far the biggest specific concern. Some parents 
suggested greater responsibility should be placed on social media 
companies to ensure the online safety of children. There were concerns 
arising from the risks associated with sharing data or personal 
information. Areas such as sexting and pornography became more 
prevalent the older the parent’s child becomes as they grow into sexual 
maturity between 11 and 17. 


Only 25% of parents agreed or strongly agreed that pupils are getting the 
information they need to thrive and stay safe in the modern world, which 
indicated that parents would endorse further initiatives to protect children 
online and keep their data private. 


22% of parents told us that their child had a negative experience of social 
media. Whilst peer-to-peer interactions may be outside of the remit of the 
consultation, it should be considered relevant because a child’s worldview 
can magnify the significance of interactions, online or otherwise, leaving 
them more vulnerable than adults and more easily persuadable, especially 
to harmful experiences such as becoming a target for grooming. 
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The vital importance of the issue among parents is illustrated in the fact 
that 92% had talked about online safety with their child, but out of the 
same sample, only 45% felt that their child is equipped with enough 
knowledge to stay safe online. This is indicative that while almost all 
parents feel that online safety knowledge and skills are of critical 
importance to their child’s wellbeing, they do not think that they and/or 
schools are able to provide children will all the skills they need to stay 
safe online. There is a role for schools to play in this: 88% and 96% of 
parents agreed that age-appropriate RE/RSE (updated to include the 
digital world) should be taught in primary and secondary schools 
respectively, showing that parents recognise the value and importance of 
it, but as only 7% think sex education doesn’t need updating, parents are 
concerned that the current teaching of sex education at school does not 
take the digital world sufficiently into account. The 8% increase in the 
same parents who think RSE should be taught in secondary compared to 
RE in primary schools shows that parents consider that online safety 
issues become more pressing the older the child is, once they reach 
secondary school and adolescence. As children can give consent to the 
processing of their data online at the age of 13, this Rubicon is reached 
part-way through their secondary school years, and at a time when 
parents are the overall decision-makers on behalf of their child, and will 
be for the next five years before their child becomes an adult at 18. 
Despite largely trusting schools to teach their child the necessary skills to 
safely use digital platforms, parents also believe they have a strong role 
to play. 77% believe that informing children about sexual health and 
relationships is primarily the responsibility of schools and parents working 
in partnership, with only 22% suggesting parents alone, and less than 1% 
schools alone. 


Consideration should also be taken on the effect of children’s screen time 
on their learning and social interactions at home, where they spend most 
of their time. Many parents set boundaries and time restraints on their 
child's screen time in an effort to provide a balance between their child’s 
online / real-life interactions. More research needs to be done on the 
impact of growing up accepting an online life as normal. Xennials (people 
born in the late 1970s/early 1980s) who are parents will have the most 
nuanced insight into this, because they are the last generation to 
complete childhood prior to the digital age, but were young enough to 
embrace the internet and its impact on society when it came along. They 
are in a unique position to assist corporations, government, tech 
companies and others with parental guidance. 


It is therefore necessary to work with parents, who are ultimately 
responsible for their child, in helping them to understand the implications 
of their child consenting to allow their data to be processed, so that they 
can fully grasp the best ways they can support their child in navigating 
the digital world safely. 
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The United Nations Convention on the Rights of the Child 


The Data Protection Act 2018 requires the Commissioner to take account 
of the UK’s obligations under the UN Convention on the Rights of the Child 
when drafting the Code. 


Q3. Please provide any views or evidence you have on how the 
Convention might apply in the context of setting design standards for the 
processing of children’s personal data by providers of ISS (online 
services) 


Aspects of design 


The Government has provided the Commissioner with a list of areas which 
it proposes she should take into account when drafting the Code. 


These are as follows: 
e default privacy settings, 
e data minimisation standards, 
e« the presentation and language of terms and conditions and privacy 
notices, 
e uses of geolocation technology, 
e automated and semi-automated profiling, 
e transparency of paid-for activity such as product placement and 
marketing, 
the sharing and resale of data, 
the strategies used to encourage extended user engagement, 
user reporting and resolution processes and systems, 
the ability to understand and activate a child’s right to erasure, 
rectification and restriction, 
e the ability to access advice from independent, specialist advocates 
on all data rights, and 
e any other aspect of design that the commissioner considers 
relevant. 


Q4. Please provide any views or evidence you think the Commissioner 
should take into account when explaining the meaning and coverage of 
these terms in the code. 


The language used in any explanatory guidance should, as well as being 
accessible to the children it protects, be accessible to their parents, who 
should be able to readily reference the Code in the interests of supporting 
their child in navigating the digital world. Consideration should be given 
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that not all parents are highly literate, and English may not be their first 
language. It is important to provide as many parents as possible with 
access to the Code and supporting guidance/resources to help them 
understand it, making the plainly-written literature available in different 
languages. Use of multimedia formats, including infographics and videos, 
should also be considered. It would be a good idea to “road test” any 
guidance among parents, by using parent focus groups, for example. We 
would be happy to support the ICO with any initiatives to consult parents 
on guidance for the Age Appropriate Design Code. 


Q5. Please provide any views or evidence you have on the following: 


Q5A. about the opportunities and challenges you think might arise in 
setting design standards for the processing of children’s personal data by 
providers of ISS (online services), in each or any of the above areas. 


Q5B. about how the ICO, working with relevant stakeholders, might use 
the opportunities presented and positively address any challenges you 
have identified. 


Q5C. about what design standards might be appropriate (ie where the bar 
should be set) in each or any of the above areas and for each or any of 
the proposed age brackets. 


Q5D. examples of ISS design you consider to be good practice. 


QS5E. about any additional areas, not included in the list above that you 
think should be the subject of a design standard. 


The opinion of parents should be sought before and after introducing the 
Code, to see if they find it useful and if they feel it fulfils its purpose of 
safeguarding their child throughout their time online. Surveying the 
opinion of parent and child within the same family may give a rounded 
view of whether or not the Code is accessible and understandable to its 
intended audience. Parentkind is happy to assist the ICO with consulting 
parents. 
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Q6. If you would be interested in contributing to future solutions focussed 
work in developing the content of the code please provide the following 
information. The Commissioner is particularly interested in hearing from 
bodies representing the views of children or parents, child development 
experts and trade associations representing providers of online services 
likely to be accessed by children, in this respect. 


Nene 
i 


Brief summary of what you think you could offer: Parentkind acts as a 
voice for parents in education in England, Wales and Northern Ireland. We 
can access a large sample of parents to gather their opinions on this 
important subject and provide parental views of statistical significance to 
the Commission. 


Further views and evidence 


Q7. Please provide any other views or evidence you have that you 
consider to be relevant to this call for evidence. 
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Section 2: About you 


Are you: 


A body representing the views or interests of children? 
Please specify: 


A body representing the views or interests of parents? 
Please specify: 

Parentkind, a charity that champions the role of parents 
in education, and acts as a membership body for parent 
groups in schools such as PTAs and Parent Councils. 


A child development expert? 
Please specify: 


A provider of ISS likely to be accessed by children? 
Please specify: 


A trade association representing ISS providers? 
Please specify: 


An ICO employee? 


Other? 
Please specify: 


Thank you for responding to this call for evidence. 
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We value your input. 
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